roycewilliams · February 22, 2024 16:40
diff --git a/bcrypt-ascending.txt b/bcrypt-ascending.txt
 #-----------------------------------------------------------------------------
 # bcrypt hashes for the plain 'password', costs 4 through 31, and how much 
 # time it took to generate the hash on a reference system (CPU).
 #-----------------------------------------------------------------------------
 #
 # htpasswd version matters - this one is from apache2-utils (2.4.18-2ubuntu3.10)
 # Note that the official Apache version now stops at bcrypt cost 18:
 #
 #     https://bz.apache.org/bugzilla/show_bug.cgi?id=62078
 #
 # I am not sure if the Ubuntu version is being modified downstream.
 #
 # bcrypt-cli (https://github.com/bitnami/bcrypt-cli) supports costs up to 31,
 # but is slightly (~20%?) slower.
 #
 # CPU: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
 # (You should always test bcrypt processing times in your own environment!)
 #
 # Scripted with:
 #
 # for cost in $(seq 1 31); do 
 #
 #    echo "- Cost: $cost"
 #
 #    # Apache method
 #    time htpasswd -bnBC "$cost" "" password | tr -d ':\n'
 #
 #    # bcrypt-cli method
 #    # echo -n "password" | time bcrypt-cli -c "$cost"
 #
 #    echo ""
 # done
 #
 #
 # Potential uses:
 #
 # - Picking a cost for a non-interactive / non-web purpose
 #
 # - Showing the scale of difficulty to the uninitiated
 #
 # - Deliberately delayed authentication of specific duration 
 #   (like Louis Wu's droud timer)
 #
 #----------------------------------------------------------------------------
 - Cost: 1
 htpasswd: Unable to encode with bcrypt: Invalid argument

 real	0m0.002s
 user	0m0.003s
 sys	0m0.000s

 - Cost: 2
 htpasswd: Unable to encode with bcrypt: Invalid argument

 real	0m0.002s
 user	0m0.002s
 sys	0m0.002s

 - Cost: 3
 htpasswd: Unable to encode with bcrypt: Invalid argument

 real	0m0.002s
 user	0m0.003s
 sys	0m0.000s

 - Cost: 4
 $2y$04$zUcb3oYdYO2qDyL7.PcYLe6LEmQ/opRhWvZu00X9AN4DSkDXMgnPO
 real	0m0.005s
 user	0m0.005s
 sys	0m0.001s

 - Cost: 5
 $2y$05$zBSxEpfbkATn4dlMz5D.N.TmC.IHqZm.FbNVq8btct725AR.ZhnNq
 real	0m0.006s
 user	0m0.007s
 sys	0m0.000s

 - Cost: 6
 $2y$06$kw6gjuHS67Of5YrX.DII7ejTf69pLQfsf9JtwAWMAucbbpeGKQ5Ue
 real	0m0.006s
 user	0m0.003s
 sys	0m0.004s

 - Cost: 7
 $2y$07$9lgxIxaRmiXb3gpCFU/lculmXqGiSNnK.uAnZooNmv8Ng3CNv515G
 real	0m0.015s
 user	0m0.015s
 sys	0m0.000s

 - Cost: 8
 $2y$08$e9vYvkoOWF3uNGQw8vZ4ieLglE.drzpUTGoAjjSo51Lm0PRUHP4OK
 real	0m0.023s
 user	0m0.024s
 sys	0m0.000s

 - Cost: 9
 $2y$09$Mx7FsppJiL34mQBKChHGn.7p/T96MFgq.NYEnLcFqyyps6TW2wJ36
 real	0m0.042s
 user	0m0.037s
 sys	0m0.005s

 - Cost: 10
 $2y$10$PkfCah3bEQJOff2Av8GkJ.juUdfDg.WsXU8r50Wu7PivT7YUoBR6K
 real	0m0.066s
 user	0m0.067s
 sys	0m0.000s

 - Cost: 11
 $2y$11$lvST5XPMtpDodYP8/ZXIT.8fVsRBk7uWryduk1ewrhwsZWncRtdvO
 real	0m0.129s
 user	0m0.130s
 sys	0m0.000s

 - Cost: 12
 $2y$12$4HzMep8Ak2aXyx9Ldg32qOWYR5qSCxrQH619Ejk4qgmLZPq5.Sf4K
 real	0m0.256s
 user	0m0.256s
 sys	0m0.000s

 - Cost: 13
 $2y$13$3JCqbefwKyyzgR8.IdVGMudxy.7W4yghyFvtAzUDkKM2HowZe0b/W
 real	0m0.512s
 user	0m0.512s
 sys	0m0.000s

 - Cost: 14
 $2y$14$Z46Ln93GFXIakqH1biIJ8.CR79GioDktj20zXjAj4en176nYh2rtC
 real	0m1.018s
 user	0m1.017s
 sys	0m0.000s

 - Cost: 15
 $2y$15$RPJHiKStBqW8FvrvyJcXyOXuXJld8MI/NvRtM5aqn1ukFSQ0wfpDq
 real	0m2.041s
 user	0m2.034s
 sys	0m0.004s

 - Cost: 16
 $2y$16$KD9fZnChvPywOBc0hdu8qOpWhlCr3m/FkHOvgrzgPQOztnN/w/txO
 real	0m4.071s
 user	0m4.068s
 sys	0m0.000s

 - Cost: 17
 $2y$17$CFynrxJcrFM7XOH4bfyhgOiKQKwumiqNT2SMd5FmaeBDDqjrR6yA.
 real	0m8.164s
 user	0m8.158s
 sys	0m0.000s

 - Cost: 18
 $2y$18$uEa4KQBi.wkMyNE4LYXjeOc.YFXFzq7wzyrxXXEImQG1c0DyVgO2u
 real	0m16.285s
 user	0m16.276s
 sys	0m0.000s

 - Cost: 19
 $2y$19$shEBjel9XaQ.cPXPuoAS9ea.IBXJuAW837ZK4MPsuCEgr5XvK20fG
 real	0m32.621s
 user	0m32.595s
 sys	0m0.008s

 - Cost: 20
 $2y$20$V7z8J4Cfuo5SUDyFJH8b8.l.4PR9pfuJbd/g63tQ/QJ8baIftnq.y
 real	1m5.603s
 user	1m5.561s
 sys	0m0.004s

 - Cost: 21
 $2y$21$NZduXKF2kNxkaongvEz5i.wcAj4kus.5DmaAtYNGSbHMk0.azRgZ6
 real	2m10.473s
 user	2m10.455s
 sys	0m0.004s

 - Cost: 22
 $2y$22$Im5UbasBJ/6KRNttVndLWu3x8JpxrQJ49vI0Z7YJnCWCvEavJValy
 real	4m21.839s
 user	4m21.831s
 sys	0m0.004s

 - Cost: 23
 $2y$23$z1qQv6ZTEQ8dasK.EbmJdOM7SlanxgXpRanP.6m5.Vi9RZeMwEot6
 real	8m42.773s
 user	8m42.757s
 sys	0m0.012s

 - Cost: 24
 $2y$24$0hhXeKintWYZZ/bNWYD6teGc112CxEmQ09z4OdIcpAycS6B410SRG
 real	17m24.544s
 user	17m24.504s
 sys	0m0.032s

 - Cost: 25
 $2y$25$hsKNdUHOjyWsULyc4xN.5OsIup9VMP6qnitOCVkqXIqbu.0bayVpS
 real	34m48.879s
 user	34m48.789s
 sys	0m0.072s

 - Cost: 26
 $2y$26$LQm0cQe2zojp5gQM65lyieFYElDrP7YWPbHs1cJ2VNqDNzEpipEBi
 real	68m30.850s
 user	68m30.684s
 sys	0m0.136s

 - Cost: 27
 $2y$27$e1q3A7jHpxH4B0TQT2KsFuNKG/GR57FhY9PDUm88wID.di4bSIBha
 real	140m23.573s
 user	140m22.341s
 sys	0m0.561s

 - Cost: 28
 $2y$28$V.miHX07kpYLnjYhfLdU8uw0Y7NkTee9289wnwGZ5hZwmGJ2mMy.u
 real	280m37.341s
 user	280m36.200s
 sys	0m0.720s

 - Cost: 29
 $2y$29$V.LYLzsFgpYlYXn2FExyv.O3KxhIN9pAL2R9PDJ6mpw8VaC2ruqJ.
 real	560m6.993s
 user	559m58.479s
 sys	0m2.988s

 - Cost: 30
 $2y$30$dOWc47CsjYLHsconSo9Yxekc7BwI8C1/D5bMGwxnJ9Wp0ikouUMA.
 real	1112m24.634s
 user	1111m55.195s
 sys	0m14.688s

 - Cost: 31
 $2y$31$e5QhU4UPYQB28iFvEFrNr.wk7/ApOepFcEQ/2eBRhFX0M/QP6P0Ze
 real	2248m36.388s
 user	2245m57.611s
 sys	2m22.707s
	#-----------------------------------------------------------------------------
	# bcrypt hashes for the plain 'password', costs 4 through 31, and how much
	# time it took to generate the hash on a reference system (CPU).
	#-----------------------------------------------------------------------------
	#
	# htpasswd version matters - this one is from apache2-utils (2.4.18-2ubuntu3.10)
	# Note that the official Apache version now stops at bcrypt cost 18:
	#
	# https://bz.apache.org/bugzilla/show_bug.cgi?id=62078
	#
	# I am not sure if the Ubuntu version is being modified downstream.
	#
	# bcrypt-cli (https://github.com/bitnami/bcrypt-cli) supports costs up to 31,
	# but is slightly (~20%?) slower.
	#
	# CPU: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
	# (You should always test bcrypt processing times in your own environment!)
	#
	# Scripted with:
	#
	# for cost in $(seq 1 31); do
	#
	# echo "- Cost: $cost"
	#
	# # Apache method
	# time htpasswd -bnBC "$cost" "" password \| tr -d ':\n'
	#
	# # bcrypt-cli method
	# # echo -n "password" \| time bcrypt-cli -c "$cost"
	#
	# echo ""
	# done
	#
	#
	# Potential uses:
	#
	# - Picking a cost for a non-interactive / non-web purpose
	#
	# - Showing the scale of difficulty to the uninitiated
	#
	# - Deliberately delayed authentication of specific duration
	# (like Louis Wu's droud timer)
	#
	#----------------------------------------------------------------------------
	- Cost: 1
	htpasswd: Unable to encode with bcrypt: Invalid argument

	real 0m0.002s
	user 0m0.003s
	sys 0m0.000s

	- Cost: 2
	htpasswd: Unable to encode with bcrypt: Invalid argument

	real 0m0.002s
	user 0m0.002s
	sys 0m0.002s

	- Cost: 3
	htpasswd: Unable to encode with bcrypt: Invalid argument

	real 0m0.002s
	user 0m0.003s
	sys 0m0.000s

	- Cost: 4
	$2y$04$zUcb3oYdYO2qDyL7.PcYLe6LEmQ/opRhWvZu00X9AN4DSkDXMgnPO
	real 0m0.005s
	user 0m0.005s
	sys 0m0.001s

	- Cost: 5
	$2y$05$zBSxEpfbkATn4dlMz5D.N.TmC.IHqZm.FbNVq8btct725AR.ZhnNq
	real 0m0.006s
	user 0m0.007s
	sys 0m0.000s

	- Cost: 6
	$2y$06$kw6gjuHS67Of5YrX.DII7ejTf69pLQfsf9JtwAWMAucbbpeGKQ5Ue
	real 0m0.006s
	user 0m0.003s
	sys 0m0.004s

	- Cost: 7
	$2y$07$9lgxIxaRmiXb3gpCFU/lculmXqGiSNnK.uAnZooNmv8Ng3CNv515G
	real 0m0.015s
	user 0m0.015s
	sys 0m0.000s

	- Cost: 8
	$2y$08$e9vYvkoOWF3uNGQw8vZ4ieLglE.drzpUTGoAjjSo51Lm0PRUHP4OK
	real 0m0.023s
	user 0m0.024s
	sys 0m0.000s

	- Cost: 9
	$2y$09$Mx7FsppJiL34mQBKChHGn.7p/T96MFgq.NYEnLcFqyyps6TW2wJ36
	real 0m0.042s
	user 0m0.037s
	sys 0m0.005s

	- Cost: 10
	$2y$10$PkfCah3bEQJOff2Av8GkJ.juUdfDg.WsXU8r50Wu7PivT7YUoBR6K
	real 0m0.066s
	user 0m0.067s
	sys 0m0.000s

	- Cost: 11
	$2y$11$lvST5XPMtpDodYP8/ZXIT.8fVsRBk7uWryduk1ewrhwsZWncRtdvO
	real 0m0.129s
	user 0m0.130s
	sys 0m0.000s

	- Cost: 12
	$2y$12$4HzMep8Ak2aXyx9Ldg32qOWYR5qSCxrQH619Ejk4qgmLZPq5.Sf4K
	real 0m0.256s
	user 0m0.256s
	sys 0m0.000s

	- Cost: 13
	$2y$13$3JCqbefwKyyzgR8.IdVGMudxy.7W4yghyFvtAzUDkKM2HowZe0b/W
	real 0m0.512s
	user 0m0.512s
	sys 0m0.000s

	- Cost: 14
	$2y$14$Z46Ln93GFXIakqH1biIJ8.CR79GioDktj20zXjAj4en176nYh2rtC
	real 0m1.018s
	user 0m1.017s
	sys 0m0.000s

	- Cost: 15
	$2y$15$RPJHiKStBqW8FvrvyJcXyOXuXJld8MI/NvRtM5aqn1ukFSQ0wfpDq
	real 0m2.041s
	user 0m2.034s
	sys 0m0.004s

	- Cost: 16
	$2y$16$KD9fZnChvPywOBc0hdu8qOpWhlCr3m/FkHOvgrzgPQOztnN/w/txO
	real 0m4.071s
	user 0m4.068s
	sys 0m0.000s

	- Cost: 17
	$2y$17$CFynrxJcrFM7XOH4bfyhgOiKQKwumiqNT2SMd5FmaeBDDqjrR6yA.
	real 0m8.164s
	user 0m8.158s
	sys 0m0.000s

	- Cost: 18
	$2y$18$uEa4KQBi.wkMyNE4LYXjeOc.YFXFzq7wzyrxXXEImQG1c0DyVgO2u
	real 0m16.285s
	user 0m16.276s
	sys 0m0.000s

	- Cost: 19
	$2y$19$shEBjel9XaQ.cPXPuoAS9ea.IBXJuAW837ZK4MPsuCEgr5XvK20fG
	real 0m32.621s
	user 0m32.595s
	sys 0m0.008s

	- Cost: 20
	$2y$20$V7z8J4Cfuo5SUDyFJH8b8.l.4PR9pfuJbd/g63tQ/QJ8baIftnq.y
	real 1m5.603s
	user 1m5.561s
	sys 0m0.004s

	- Cost: 21
	$2y$21$NZduXKF2kNxkaongvEz5i.wcAj4kus.5DmaAtYNGSbHMk0.azRgZ6
	real 2m10.473s
	user 2m10.455s
	sys 0m0.004s

	- Cost: 22
	$2y$22$Im5UbasBJ/6KRNttVndLWu3x8JpxrQJ49vI0Z7YJnCWCvEavJValy
	real 4m21.839s
	user 4m21.831s
	sys 0m0.004s

	- Cost: 23
	$2y$23$z1qQv6ZTEQ8dasK.EbmJdOM7SlanxgXpRanP.6m5.Vi9RZeMwEot6
	real 8m42.773s
	user 8m42.757s
	sys 0m0.012s

	- Cost: 24
	$2y$24$0hhXeKintWYZZ/bNWYD6teGc112CxEmQ09z4OdIcpAycS6B410SRG
	real 17m24.544s
	user 17m24.504s
	sys 0m0.032s

	- Cost: 25
	$2y$25$hsKNdUHOjyWsULyc4xN.5OsIup9VMP6qnitOCVkqXIqbu.0bayVpS
	real 34m48.879s
	user 34m48.789s
	sys 0m0.072s

	- Cost: 26
	$2y$26$LQm0cQe2zojp5gQM65lyieFYElDrP7YWPbHs1cJ2VNqDNzEpipEBi
	real 68m30.850s
	user 68m30.684s
	sys 0m0.136s

	- Cost: 27
	$2y$27$e1q3A7jHpxH4B0TQT2KsFuNKG/GR57FhY9PDUm88wID.di4bSIBha
	real 140m23.573s
	user 140m22.341s
	sys 0m0.561s

	- Cost: 28
	$2y$28$V.miHX07kpYLnjYhfLdU8uw0Y7NkTee9289wnwGZ5hZwmGJ2mMy.u
	real 280m37.341s
	user 280m36.200s
	sys 0m0.720s

	- Cost: 29
	$2y$29$V.LYLzsFgpYlYXn2FExyv.O3KxhIN9pAL2R9PDJ6mpw8VaC2ruqJ.
	real 560m6.993s
	user 559m58.479s
	sys 0m2.988s

	- Cost: 30
	$2y$30$dOWc47CsjYLHsconSo9Yxekc7BwI8C1/D5bMGwxnJ9Wp0ikouUMA.
	real 1112m24.634s
	user 1111m55.195s
	sys 0m14.688s

	- Cost: 31
	$2y$31$e5QhU4UPYQB28iFvEFrNr.wk7/ApOepFcEQ/2eBRhFX0M/QP6P0Ze
	real 2248m36.388s
	user 2245m57.611s
	sys 2m22.707s